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For several decades it was believed that information-secure key distribution requires both the sender and 
receiver to have the ability to generate and/or manipulate quantum states. In 2007, we showed (together with 
Kenigsberg) that quantum key distribution in which one party is classical, is possible. A surprising and very 
nice extension of that result, was suggested by Zou, Qiu, Li, Wu, and Li. Their paper suggests that it is sufficient 
for the originator of the states (the person holding the quantum technology) to generate just one state! 

The resulting semiquantum key distribution, which we call here "quantum key distribution with classical 
Alice", is indeed completely robust against eavesdropping. However, their proof (that no eavesdropper can get 
information without being possibly detected), is faulty. We provide here a fully detailed and direct proof of their 
very important result. 



A two-way Quantum Key Distribution (QKD) protocol in 
which one of the parties (Bob) uses only classical operations 
was recently introduced [1]. A very interesting extension in 
which the originator always sends the same state |+) (while 
in [1] all four BB84 states are sent) is suggested by Zou et 
al. [2]. In both those semi-quantum- KD (SQKD) protocols 
the qubits go from the originator Alice to (classical) Bob and 
back to Alice. Bob either reflects a received qubit without 
touching its state (CTRL), or measures it in the standard (clas- 
sical) basis and sends back his result as |0) or 1 1) (SIFT). 

We prefer to call the originator in [2] Bob (and not Alice), 
and to call the classical party Alice: usually in quantum cryp- 
tography, Alice is the sender of some non-trivial data, e.g., 
she is the one choosing the quantum states. The originator 
in [2] does not have that special role, as the state |+) is al- 
ways sent (and we could even ask Eve to generate it). The 
classical person is then the one actually choosing a basis and 
knowing which of the three state ( |0), 1 1), or |+)) is sent back 
to the originator, thus it is natural to name that classical per- 
son Alice. We call the originator Bob, and we call the SQKD 
protocol of Zou et al "QKD with classical Alice". 

QKD with Classical Alice [2] is indeed completely robust 
against eavesdropping. However, their proof (that no eaves- 
dropper can get information without being possibly detected), 
is faulty. Their result is stated in Theorem 5 which relies, 
after many steps, on their Lemma 1 . Since the Lemmas are 
correct and only parts of the proofs are wrong, it is not at all 
easy to pinpoint errors. We explicitly single out two interwo- 
ven problems in Lemma 1: 1. — They state (Lemma 1, first 
lines) that The originator's final state p' B is a product state 
(in SQKD Protocol 2), prior to saying "If the attack (Ue,Uf) 
induces no error on CTRL...", however, this statement is in- 
accurate; in order to prove that Bob's final state is a product 
state one must make use of the fact that the attack induces 
no errors on CTRL bits. 2. — They state (Proof of Lemma 1, 
first lines): Because the originator (Bob) sends a qubit only 
after receiving the previous one, the qubits he received are 
in a tensor product form, i.e. p' B = p[ B ® ■ ■ ■ ® p' N l . That 
is not true in general. Consider, for instance, an attack on 
two consequative qubits: if Eve has a one qubit probe initial- 
ized as |0) and uses each of the two incoming qubits from 
Bob as a control bit to apply a controlled-not gate (such that 



the NOT is applied onto her probe), then her probe keeps the 
parity of the two qubits sent by Bob; if the classical party 
(Alice) reflects both qubits (CTRL), the final global state 
is i[[|00) B +|ll) B ] |0) £ + [|01) B +|10) B ]|1) £ ] and, once 
Eve's state is traced-out, the resulting state in Bob's hands 
is not a product state. 

We now prove that the final result is indeed correct: ro- 
bustness can be proven, directly, as follows. The originator 
Bob keeps in a quantum memory all qubits he received from 
Alice. When N qubits have been sent and received, classical 
Alice announces publicly the qubits she reflected; the origi- 
nator Bob then checks that he received |+) on those positions 
(CTRL). For the qubits measured by Alice, a sample is chosen 
to be checked for errors (TEST). 

Without loss of generality, we assume Eve uses a unique 
probe space for the attacks on all qubits and that her initial 
state |£b) is pure. The analysis is now done bitwise, by in- 
duction. It is assumed that the Bob+Alice+Eve global state 
prior to Eve attacking qubit number i is a tensor product state 
\yP A y) ® \Ei-\) where Iv^i) is in Bob+Alice's hands and 
Eve's current state |.E,_i) is independent of all bits measured 
by Alice (SIFT). That induction hypothesis obviously holds 
for i = 1, before the first qubit is sent [3]. Eve knows that 
Bob only sends |+) and she is free to send whatever state she 
wants to Alice. WLG (although she is assumed classical) Al- 
ice may delay measuring by using a one-qubit probe and an 
XOR gate to SIFT [1]. The global state before she decides 
whether she sifts or reflects can now be written 

W* a 1 )®[\W)ba\E' )+\IQ) b a\E[)] 

where \E' b ) are two un-normalized states of Eve's probe. In 
particular, if Eve "does nothing" ( \E ! ) = \E[)), Bob+Alices's 
state for the /-th qubit is | + 0) . On the qubit coming back, Eve 
applies the unitary Vj; if Alice sifted, the global state before 
Eve applies V t is ® [|00) BA \E' Q ) +\U)ba \E[)\. Once 

Eve has applied Vj, it must be such that V; |0) B \Eq) = l-^o) 
else the TEST (in the classical basis) can detect an error, and 
similarly Vj | \) B \E[) = \1)b \F{) . Due to the linearity of quan- 
tum mechanics, if classical Alice reflects (CTRL), the result- 
ing final state must be 

\Yn)®[\00)BA\F£)+\10)BA\Fl)}. 
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Replacing now |0)j? by 
[\+) B - |-) B ]/v/2 gives 
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) b to have probability of being measured by Bob, 
\F[) must hold; letting \E t ) = V2\F^) = y/2\F{), the fi- 



nal global state is |yf A )® \Ei) with |i//f A ) = WPA)^Wi BA ) 
where 

,lBA\ 



Yl BA ) = (1/V2) [ |00) BA + 1 1 l) BA ] if Alice shifts, and 
= I + °)ba if she reflects. 
This completes the induction proof and we deduce that af- 
ter all N qubits have been processed, the final global state is 
| Yn A ) ® \Fn) an d Eve's state \Eff) is independent of all Al- 
ice's choices, and thus of her information bits. That proves 



the robustness of the protocol. 

We proved here that the very nice protocol suggested by 
Zou et al (which we call here "QKD with classical Alice") 
is completely robust. We would like to emphasize that the 
results in [2] hold. As for Lemma 1, its statement can be 
slightly improved by moving the sentence "Alice's final state 
... is a product state... in SQKD Protocol 2.", till right af- 
ter "... the following conditions:". Proving Lemma 1, how- 
ever, is another matter, and it is unclear to us how the orig- 
inal proof can be adjusted. Interestingly, it follows directly 
from our proof above that the final Bob+ Alice state \yf BA ) 
is |y/jf A ) ® <8$Li where |i//,f A ) is the Bob+Alice state 

before the protocol, and the | y- BA ) are exactly those states an- 
nounced by [2] in their Lemma 1, which thus proves it for the 
"one state" protocol. 
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